@farukada/aws-langgraph-dynamodb-ts 0.7.0 → 0.8.0

package/dist/shared/dynamodb/retry-classifier.js.map

@@ -1 +1 @@
-{"version":3,"file":"retry-classifier.js","sourceRoot":"","sources":["../../../src/shared/dynamodb/retry-classifier.ts"],"names":[],"mappings":";;;;AAAA,iDAAwD;AAExD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;GAIG;AACU,QAAA,wBAAwB,GAAsB;IACzD,wCAAwC;IACxC,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,8BAA8B;IAC9B,gCAAgC;IAChC,gBAAgB;IAChB,yBAAyB;IACzB,YAAY;IACZ,cAAc;IACd,WAAW;IACX,OAAO;IACP,WAAW;IACX,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,8BAA8B,GAAsB;IACxD,MAAM;IACN,qBAAqB;IACrB,iBAAiB;IACjB,+BAA+B;CAChC,CAAC;AAEF;;;;GAIG;AACH,SAAS,gCAAgC,CAAC,KAAY;IACpD,MAAM,OAAO,GAAG,IAAA,qCAAsB,EAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,OAAO,OAAO,CAAC,KAAK,CAClB,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAC9F,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAY;IAClC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,IAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,eAAe,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,IAMd,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,0BAAiC,KAAY,EAAE,eAAkC;IAC/E,MAAM,YAAY,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACpD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC"}
+{"version":3,"file":"retry-classifier.js","sourceRoot":"","sources":["../../../src/shared/dynamodb/retry-classifier.ts"],"names":[],"mappings":";;;;AAAA,iDAAwD;AAExD,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;GAIG;AACU,QAAA,wBAAwB,GAAsB;IACzD,wCAAwC;IACxC,qBAAqB;IACrB,sBAAsB;IACtB,qBAAqB;IACrB,oBAAoB;IACpB,8BAA8B;IAC9B,gCAAgC;IAChC,gBAAgB;IAChB,yBAAyB;IACzB,YAAY;IACZ,cAAc;IACd,WAAW;IACX,OAAO;IACP,WAAW;IACX,iBAAiB;IACjB,cAAc;CACf,CAAC;AAEF;;;;GAIG;AACH,MAAM,8BAA8B,GAAsB;IACxD,MAAM;IACN,qBAAqB;IACrB,iBAAiB;IACjB,+BAA+B;CAChC,CAAC;AAEF;;;;GAIG;AACH,SAAS,gCAAgC,CAAC,KAAY;IACpD,MAAM,OAAO,GAAG,IAAA,qCAAsB,EAAC,KAAK,CAAC,CAAC;IAC9C,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B;;;;;;OAMG;IACH,OAAO,CACL,OAAO,CAAC,MAAM,GAAG,CAAC;QAClB,OAAO,CAAC,KAAK,CACX,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,8BAA8B,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAC9F,CACF,CAAC;AACJ,CAAC;AAED,SAAS,cAAc,CAAC,KAAY;IAClC,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,IAAW,EAAE,KAAa,EAAQ,EAAE;QAChD,IAAI,KAAK,GAAG,eAAe,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3F,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,IAMd,CAAC;QACF,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7E,IAAI,OAAO,KAAK,KAAK,QAAQ;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,CAAC,KAAK;YAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IACf,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,gFAAgF;AAChF,0BAAiC,KAAY,EAAE,eAAkC;IAC/E,MAAM,YAAY,GAAG,gCAAgC,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,YAAY,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IACpD,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;AACnG,CAAC"}

package/dist/shared/logging/redaction-walk.d.ts

@@ -0,0 +1,23 @@
+/** A value that {@link redactSecrets} can recurse through. */
+export type Redactable = string | number | boolean | null | undefined | Redactable[] | {
+    [key: string]: Redactable;
+};
+/** Any `Redactable` that is a non-null object — what the walk dispatches on. */
+export type RedactableObject = Redactable[] | {
+    [key: string]: Redactable;
+};
+/** One step of the recursive walk, threaded into the entry helpers. */
+export type Walk = (value: Redactable) => Redactable;
+/** Collaborators threaded through the recursive walk. */
+export interface WalkDeps {
+    keyPatterns: readonly string[];
+    valuePatterns: readonly RegExp[];
+    walk: Walk;
+}
+/**
+ * Dispatch one non-null object by its shape: arrays and plain objects recurse,
+ * binary views collapse to a label, `Date`/`RegExp` pass through by reference,
+ * `Set`/`Map` render as their contents, and an Error takes the path above.
+ */
+export declare function walkObject(current: RedactableObject, deps: WalkDeps): Redactable;
+//# sourceMappingURL=redaction-walk.d.ts.map

package/dist/shared/logging/redaction-walk.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction-walk.d.ts","sourceRoot":"","sources":["../../../src/shared/logging/redaction-walk.ts"],"names":[],"mappings":"AAEA,8DAA8D;AAC9D,MAAM,MAAM,UAAU,GACpB,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAE9F,gFAAgF;AAChF,MAAM,MAAM,gBAAgB,GAAG,UAAU,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAE5E,uEAAuE;AACvE,MAAM,MAAM,IAAI,GAAG,CAAC,KAAK,EAAE,UAAU,KAAK,UAAU,CAAC;AAErD,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACvB,WAAW,EAAE,SAAS,MAAM,EAAE,CAAC;IAC/B,aAAa,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,IAAI,EAAE,IAAI,CAAC;CACZ;AAiFD;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,GAAG,UAAU,CAShF"}

package/dist/shared/logging/redaction-walk.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.walkObject = walkObject;
+const secret_patterns_1 = require("./secret-patterns");
+/** True when `value` is a Set, tested by tag so a cross-realm Set still matches. */
+function isSetValue(value) {
+    return Object.prototype.toString.call(value) === '[object Set]';
+}
+/** True when `value` is a Map, tested by tag so a cross-realm Map still matches. */
+function isMapValue(value) {
+    return Object.prototype.toString.call(value) === '[object Map]';
+}
+/** True when `value` is an Error (or subclass), tested by tag not `instanceof`. */
+function isErrorValue(value) {
+    return Object.prototype.toString.call(value) === '[object Error]';
+}
+/**
+ * True for a value whose identity matters more than its own properties.
+ * `Date` and `RegExp` have none, so recursing either would yield a bare `{}`.
+ */
+function isOpaqueValue(value) {
+    const tag = Object.prototype.toString.call(value);
+    return tag === '[object Date]' || tag === '[object RegExp]';
+}
+/** Rebuild entries into a plain object, redacting values at secret-looking keys. */
+function redactEntries(entries, keyPatterns, walk) {
+    const out = {};
+    for (const [key, value] of entries) {
+        out[key] = (0, secret_patterns_1.isSecretKey)(key, keyPatterns) ? secret_patterns_1.REDACTED : walk(value);
+    }
+    return out;
+}
+/**
+ * A Map's entries as an object. Keys are stringified so a non-string key is
+ * still reported rather than dropped, and each is checked against the
+ * secret-key patterns exactly as a plain object's own keys are.
+ */
+function redactMap(value, deps) {
+    const entries = [...value].map(([key, entry]) => [String(key), entry]);
+    return redactEntries(entries, deps.keyPatterns, deps.walk);
+}
+/**
+ * Rebuild an Error as a plain object carrying its redacted text alongside its
+ * redacted own properties. The one exception is an Error with no own
+ * enumerable data whose text holds no secret: it is returned by reference so
+ * its identity and stack trace survive, which is what keeps a caught error
+ * useful in a log.
+ *
+ * `cause` is copied explicitly because `new Error(msg, { cause })` defines it
+ * as *non-enumerable* per spec, so `Object.entries` never sees it. Without
+ * this the whole chain vanished on every rebuild — and the rebuild always
+ * fires for this library's own error types, since each attaches an enumerable
+ * `code`/`context`. A redacted `RetryExhaustedError` would then no longer say
+ * whether the underlying failure was a throttle, a validation error or a
+ * network fault, which is the entire reason it carries a cause. Recursing it
+ * through `walk` redacts the chain too, and the cycle guard handles a cause
+ * that points back at its own wrapper.
+ */
+function redactError(current, entries, deps) {
+    const text = (0, secret_patterns_1.redactErrorText)(current, deps.valuePatterns);
+    if (entries.length === 0 && !text.changed)
+        return current;
+    const out = redactEntries(entries, deps.keyPatterns, deps.walk);
+    out.name = text.name;
+    out.message = text.message;
+    out.stack = text.stack;
+    if (current.cause !== undefined)
+        out.cause = deps.walk(current.cause);
+    return out;
+}
+/**
+ * Dispatch one non-null object by its shape: arrays and plain objects recurse,
+ * binary views collapse to a label, `Date`/`RegExp` pass through by reference,
+ * `Set`/`Map` render as their contents, and an Error takes the path above.
+ */
+function walkObject(current, deps) {
+    if (Array.isArray(current))
+        return current.map(deps.walk);
+    if (ArrayBuffer.isView(current))
+        return (0, secret_patterns_1.binaryLabel)(current);
+    if (isOpaqueValue(current))
+        return current;
+    if (isSetValue(current))
+        return [...current].map(deps.walk);
+    if (isMapValue(current))
+        return redactMap(current, deps);
+    const entries = Object.entries(current);
+    if (isErrorValue(current))
+        return redactError(current, entries, deps);
+    return redactEntries(entries, deps.keyPatterns, deps.walk);
+}
+//# sourceMappingURL=redaction-walk.js.map

package/dist/shared/logging/redaction-walk.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction-walk.js","sourceRoot":"","sources":["../../../src/shared/logging/redaction-walk.ts"],"names":[],"mappings":";;;AAAA,uDAAwF;AAmBxF,oFAAoF;AACpF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC;AAClE,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,cAAc,CAAC;AAClE,CAAC;AAED,mFAAmF;AACnF,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,OAAO,GAAG,KAAK,eAAe,IAAI,GAAG,KAAK,iBAAiB,CAAC;AAC9D,CAAC;AAED,oFAAoF;AACpF,SAAS,aAAa,CACpB,OAAmD,EACnD,WAA8B,EAC9B,IAAU;IAEV,MAAM,GAAG,GAAkC,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACnC,GAAG,CAAC,GAAG,CAAC,GAAG,IAAA,6BAAW,EAAC,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,0BAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAkC,EAAE,IAAc;IACnE,MAAM,OAAO,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAwB,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IAC7F,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,WAAW,CAClB,OAAiC,EACjC,OAAmD,EACnD,IAAc;IAEd,MAAM,IAAI,GAAG,IAAA,iCAAe,EAAC,OAAO,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;IAC1D,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,OAAO,CAAC;IAC1D,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACrB,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAC3B,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvB,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;QAAE,GAAG,CAAC,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAmB,CAAC,CAAC;IACpF,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,oBAA2B,OAAyB,EAAE,IAAc;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,IAAI,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC;QAAE,OAAO,IAAA,6BAAW,EAAC,OAAO,CAAC,CAAC;IAC7D,IAAI,aAAa,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC3C,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACxC,IAAI,YAAY,CAAC,OAAO,CAAC;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IACtE,OAAO,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC"}

package/dist/shared/logging/redaction.d.ts

@@ -1,26 +1,31 @@
 import type { Logger } from './logger';
-/** A value that {@link redactSecrets} can recurse through. */
-export type Redactable = string | number | boolean | null | undefined | Redactable[] | {
-    [key: string]: Redactable;
-};
+import { type Redactable } from './redaction-walk';
 /**
  * Recursively clone `value`, replacing any value at a secret-looking key with
- * `[REDACTED]`. Cycles become `[Circular]`. An Error (or subclass) with no own
- * enumerable properties — a bare `new Error()`, since `message`/`stack` are
- * non-enumerable by spec — is passed through by reference unchanged, so its
- * stack trace and identity survive. A subclass carrying its own enumerable
- * data (this library's own error types all attach `code`/`context`/payload
- * fields this way) is rebuilt instead: `name`/`message`/`stack` are preserved
- * verbatim and every other own property is redacted/recursed exactly like a
- * plain object — otherwise a secret buried in a caught error's own fields
- * would ride straight through unredacted. Does not mutate the input.
+ * `[REDACTED]` and any recognised secret *shape* inside a string — including an
+ * error's `message`/`stack` text, which key-name matching cannot reach — with
+ * the same marker. Cycles become `[Circular]`.
+ *
+ * An Error with no own enumerable properties whose text holds no secret is
+ * passed through by reference, so its identity and stack trace survive; one
+ * carrying own data (this library's error types all attach `code`/`context`
+ * this way) or a secret in its text is rebuilt instead, with `name`/`message`/
+ * `stack` redacted and every other own property recursed like a plain object.
+ * `Date`/`RegExp` keep their identity rather than collapsing to `{}`,
+ * `Set`/`Map` render as their contents, and binary views become a short label.
+ * Does not mutate the input.
  */
-export declare function redactSecrets(value: Redactable, patterns?: readonly string[]): Redactable;
+export declare function redactSecrets(value: Redactable, patterns?: readonly string[], valuePatterns?: readonly RegExp[]): Redactable;
+/** Options controlling {@link redactLogger}. */
+export interface RedactLoggerOptions {
+    /** Additional key names (matched case-insensitively as substrings) to redact. */
+    extraKeys?: readonly string[];
+    /** Additional secret shapes to redact wherever they appear inside a string. */
+    extraValuePatterns?: readonly RegExp[];
+}
 /**
  * Wrap a logger so object args are redacted before delegation. The message
  * string is passed through unchanged (never interpolate secrets into it).
  */
-export declare function redactLogger(inner: Logger, options?: {
-    extraKeys?: readonly string[];
-}): Logger;
+export declare function redactLogger(inner: Logger, options?: RedactLoggerOptions): Logger;
 //# sourceMappingURL=redaction.d.ts.map

package/dist/shared/logging/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/shared/logging/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,MAAM,EAAE,MAAM,UAAU,CAAC;AAEpD,8DAA8D;AAC9D,MAAM,MAAM,UAAU,GACpB,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AA2B9F;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,QAAQ,GAAE,SAAS,MAAM,EAAgC,GACxD,UAAU,CAwBZ;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,EACb,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAO,GAC9C,MAAM,CAYR"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/shared/logging/redaction.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAe,MAAM,EAAE,MAAM,UAAU,CAAC;AACpD,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,kBAAkB,CAAC;AAO/D;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,aAAa,CAC3B,KAAK,EAAE,UAAU,EACjB,QAAQ,GAAE,SAAS,MAAM,EAAgC,EACzD,aAAa,GAAE,SAAS,MAAM,EAAkC,GAC/D,UAAU,CAcZ;AAED,gDAAgD;AAChD,MAAM,WAAW,mBAAmB;IAClC,iFAAiF;IACjF,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9B,+EAA+E;IAC/E,kBAAkB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,mBAAwB,GAAG,MAAM,CAerF"}

package/dist/shared/logging/redaction.js

@@ -2,62 +2,35 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.redactSecrets = redactSecrets;
 exports.redactLogger = redactLogger;
-const DEFAULT_SECRET_KEY_PATTERNS = [
-    'accesskey',
-    'secretkey',
-    'secret',
-    'sessiontoken',
-    'securitytoken',
-    'authorization',
-    'password',
-    'apikey',
-    'bearer',
-    'token',
-    'privatekey',
-];
-const REDACTED = '[REDACTED]';
-function isSecretKey(key, patterns) {
-    const lower = key.toLowerCase();
-    return patterns.some((pattern) => lower.includes(pattern));
-}
-function isErrorShaped(value) {
-    return Object.prototype.toString.call(value) === '[object Error]';
-}
+const redaction_walk_1 = require("./redaction-walk");
+const secret_patterns_1 = require("./secret-patterns");
 /**
  * Recursively clone `value`, replacing any value at a secret-looking key with
- * `[REDACTED]`. Cycles become `[Circular]`. An Error (or subclass) with no own
- * enumerable properties — a bare `new Error()`, since `message`/`stack` are
- * non-enumerable by spec — is passed through by reference unchanged, so its
- * stack trace and identity survive. A subclass carrying its own enumerable
- * data (this library's own error types all attach `code`/`context`/payload
- * fields this way) is rebuilt instead: `name`/`message`/`stack` are preserved
- * verbatim and every other own property is redacted/recursed exactly like a
- * plain object — otherwise a secret buried in a caught error's own fields
- * would ride straight through unredacted. Does not mutate the input.
+ * `[REDACTED]` and any recognised secret *shape* inside a string — including an
+ * error's `message`/`stack` text, which key-name matching cannot reach — with
+ * the same marker. Cycles become `[Circular]`.
+ *
+ * An Error with no own enumerable properties whose text holds no secret is
+ * passed through by reference, so its identity and stack trace survive; one
+ * carrying own data (this library's error types all attach `code`/`context`
+ * this way) or a secret in its text is rebuilt instead, with `name`/`message`/
+ * `stack` redacted and every other own property recursed like a plain object.
+ * `Date`/`RegExp` keep their identity rather than collapsing to `{}`,
+ * `Set`/`Map` render as their contents, and binary views become a short label.
+ * Does not mutate the input.
  */
-function redactSecrets(value, patterns = DEFAULT_SECRET_KEY_PATTERNS) {
+function redactSecrets(value, patterns = secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, valuePatterns = secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS) {
     const seen = new WeakSet();
     const walk = (current) => {
+        if (typeof current === 'string')
+            return (0, secret_patterns_1.redactText)(current, valuePatterns);
         if (current === null || typeof current !== 'object')
             return current;
         if (seen.has(current))
             return '[Circular]';
         seen.add(current);
         try {
-            if (Array.isArray(current))
-                return current.map(walk);
-            if (isErrorShaped(current) && Object.keys(current).length === 0)
-                return current;
-            const out = {};
-            for (const [key, val] of Object.entries(current)) {
-                out[key] = isSecretKey(key, patterns) ? REDACTED : walk(val);
-            }
-            if (isErrorShaped(current)) {
-                out.name = current.name;
-                out.message = current.message;
-                out.stack = current.stack;
-            }
-            return out;
+            return (0, redaction_walk_1.walkObject)(current, { keyPatterns: patterns, valuePatterns, walk });
         }
         finally {
             seen.delete(current);
@@ -71,9 +44,12 @@ function redactSecrets(value, patterns = DEFAULT_SECRET_KEY_PATTERNS) {
  */
 function redactLogger(inner, options = {}) {
     const patterns = options.extraKeys
-        ? [...DEFAULT_SECRET_KEY_PATTERNS, ...options.extraKeys.map((key) => key.toLowerCase())]
-        : DEFAULT_SECRET_KEY_PATTERNS;
-    const wrap = (args) => args.map((arg) => redactSecrets(arg, patterns));
+        ? [...secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS, ...options.extraKeys.map((key) => key.toLowerCase())]
+        : secret_patterns_1.DEFAULT_SECRET_KEY_PATTERNS;
+    const valuePatterns = options.extraValuePatterns
+        ? [...secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS, ...options.extraValuePatterns]
+        : secret_patterns_1.DEFAULT_SECRET_VALUE_PATTERNS;
+    const wrap = (args) => args.map((arg) => redactSecrets(arg, patterns, valuePatterns));
     return {
         info: (message, ...args) => inner.info(message, ...wrap(args)),
         warn: (message, ...args) => inner.warn(message, ...wrap(args)),

package/dist/shared/logging/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/shared/logging/redaction.ts"],"names":[],"mappings":";;;;AAMA,MAAM,2BAA2B,GAAsB;IACrD,WAAW;IACX,WAAW;IACX,QAAQ;IACR,cAAc;IACd,eAAe;IACf,eAAe;IACf,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,YAAY;CACb,CAAC;AAEF,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,SAAS,WAAW,CAAC,GAAW,EAAE,QAA2B;IAC3D,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,gBAAgB,CAAC;AACpE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,uBACE,KAAiB,EACjB,QAAQ,GAAsB,2BAA2B;IAEzD,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,OAAmB,EAAc,EAAE;QAC/C,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACpE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACrD,IAAI,aAAa,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,OAAO,CAAC;YAChF,MAAM,GAAG,GAAkC,EAAE,CAAC;YAC9C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;gBACjD,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/D,CAAC;YACD,IAAI,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC3B,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;gBACxB,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;gBAC9B,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAED;;;GAGG;AACH,sBACE,KAAa,EACb,OAAO,GAAsC,EAAE;IAE/C,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;QAChC,CAAC,CAAC,CAAC,GAAG,2BAA2B,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,CAAC,CAAC,2BAA2B,CAAC;IAChC,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAiB,EAAE,CAClD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAiB,EAAE,QAAQ,CAAgB,CAAC,CAAC;IAC/E,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;KACjE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../../src/shared/logging/redaction.ts"],"names":[],"mappings":";;;;AACA,qDAA+D;AAC/D,uDAI2B;AAE3B;;;;;;;;;;;;;;GAcG;AACH,uBACE,KAAiB,EACjB,QAAQ,GAAsB,6CAA2B,EACzD,aAAa,GAAsB,+CAA6B;IAEhE,MAAM,IAAI,GAAG,IAAI,OAAO,EAAU,CAAC;IACnC,MAAM,IAAI,GAAG,CAAC,OAAmB,EAAc,EAAE;QAC/C,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,IAAA,4BAAU,EAAC,OAAO,EAAE,aAAa,CAAC,CAAC;QAC3E,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QACpE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,YAAY,CAAC;QAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,CAAC;YACH,OAAO,IAAA,2BAAU,EAAC,OAAO,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC;IACF,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC;AACrB,CAAC;AAUD;;;GAGG;AACH,sBAA6B,KAAa,EAAE,OAAO,GAAwB,EAAE;IAC3E,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS;QAChC,CAAC,CAAC,CAAC,GAAG,6CAA2B,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;QACxF,CAAC,CAAC,6CAA2B,CAAC;IAChC,MAAM,aAAa,GAAG,OAAO,CAAC,kBAAkB;QAC9C,CAAC,CAAC,CAAC,GAAG,+CAA6B,EAAE,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACnE,CAAC,CAAC,+CAA6B,CAAC;IAClC,MAAM,IAAI,GAAG,CAAC,IAAmB,EAAiB,EAAE,CAClD,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,aAAa,CAAC,GAAiB,EAAE,QAAQ,EAAE,aAAa,CAAgB,CAAC,CAAC;IAC9F,OAAO;QACL,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,IAAI,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9D,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,KAAK,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;KACjE,CAAC;AACJ,CAAC"}

package/dist/shared/logging/secret-patterns.d.ts

@@ -0,0 +1,41 @@
+/** Marker substituted for anything recognised as secret. */
+export declare const REDACTED = "[REDACTED]";
+/** Key names (matched case-insensitively as substrings) whose value is a secret. */
+export declare const DEFAULT_SECRET_KEY_PATTERNS: readonly string[];
+/**
+ * Secret shapes recognisable in free text, where key-name matching cannot
+ * reach: an error's `message`/`stack`, or any other string value. Deliberately
+ * high-confidence — each pattern describes a credential *format* rather than a
+ * word that merely sounds sensitive — so ordinary operational text survives
+ * redaction unchanged.
+ */
+export declare const DEFAULT_SECRET_VALUE_PATTERNS: readonly RegExp[];
+/** True when `key` matches any secret-key pattern. */
+export declare function isSecretKey(key: string, patterns: readonly string[]): boolean;
+/**
+ * Replace every recognised secret shape inside `value` with {@link REDACTED},
+ * leaving the surrounding text intact so a redacted message stays readable.
+ * Each pattern is rebuilt per call so a `g` flag's `lastIndex` never leaks
+ * between invocations.
+ */
+export declare function redactText(value: string, patterns: readonly RegExp[]): string;
+/**
+ * A short label for a binary view. Recursing one would explode it into a
+ * per-index numeric map, both unreadable and far larger than the value itself.
+ */
+export declare function binaryLabel(value: ArrayBufferView): string;
+/** An Error's redacted non-enumerable text, plus whether redaction changed it. */
+export interface RedactedErrorText {
+    name: string;
+    message: string;
+    stack: string | undefined;
+    changed: boolean;
+}
+/**
+ * Redact an Error's `name`/`message`/`stack`. `changed` reports whether any
+ * secret was actually found, which is what decides between passing a bare
+ * Error through by reference (preserving its identity and stack trace) and
+ * rebuilding it so the secret cannot escape.
+ */
+export declare function redactErrorText(error: Error, patterns: readonly RegExp[]): RedactedErrorText;
+//# sourceMappingURL=secret-patterns.d.ts.map

package/dist/shared/logging/secret-patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.d.ts","sourceRoot":"","sources":["../../../src/shared/logging/secret-patterns.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,EAAE,SAAS,MAAM,EAYxD,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,EAAE,SAAS,MAAM,EAK1D,CAAC;AAEF,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAG7E;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAK7E;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,CAE1D;AAED,kFAAkF;AAClF,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,iBAAiB,CAS5F"}

package/dist/shared/logging/secret-patterns.js

@@ -0,0 +1,74 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_SECRET_VALUE_PATTERNS = exports.DEFAULT_SECRET_KEY_PATTERNS = exports.REDACTED = void 0;
+exports.isSecretKey = isSecretKey;
+exports.redactText = redactText;
+exports.binaryLabel = binaryLabel;
+exports.redactErrorText = redactErrorText;
+/** Marker substituted for anything recognised as secret. */
+exports.REDACTED = '[REDACTED]';
+/** Key names (matched case-insensitively as substrings) whose value is a secret. */
+exports.DEFAULT_SECRET_KEY_PATTERNS = [
+    'accesskey',
+    'secretkey',
+    'secret',
+    'sessiontoken',
+    'securitytoken',
+    'authorization',
+    'password',
+    'apikey',
+    'bearer',
+    'token',
+    'privatekey',
+];
+/**
+ * Secret shapes recognisable in free text, where key-name matching cannot
+ * reach: an error's `message`/`stack`, or any other string value. Deliberately
+ * high-confidence — each pattern describes a credential *format* rather than a
+ * word that merely sounds sensitive — so ordinary operational text survives
+ * redaction unchanged.
+ */
+exports.DEFAULT_SECRET_VALUE_PATTERNS = [
+    /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g,
+    /\bBearer\s+[A-Za-z0-9._~+/-]+=*/gi,
+    /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
+    /(?:aws_)?(?:secret_access_key|secretaccesskey|password|passwd|api_?key|token)\s*[=:]\s*\S+/gi,
+];
+/** True when `key` matches any secret-key pattern. */
+function isSecretKey(key, patterns) {
+    const lower = key.toLowerCase();
+    return patterns.some((pattern) => lower.includes(pattern));
+}
+/**
+ * Replace every recognised secret shape inside `value` with {@link REDACTED},
+ * leaving the surrounding text intact so a redacted message stays readable.
+ * Each pattern is rebuilt per call so a `g` flag's `lastIndex` never leaks
+ * between invocations.
+ */
+function redactText(value, patterns) {
+    return patterns.reduce((text, pattern) => text.replace(new RegExp(pattern.source, pattern.flags), exports.REDACTED), value);
+}
+/**
+ * A short label for a binary view. Recursing one would explode it into a
+ * per-index numeric map, both unreadable and far larger than the value itself.
+ */
+function binaryLabel(value) {
+    return `[${value.constructor.name}(${value.byteLength})]`;
+}
+/**
+ * Redact an Error's `name`/`message`/`stack`. `changed` reports whether any
+ * secret was actually found, which is what decides between passing a bare
+ * Error through by reference (preserving its identity and stack trace) and
+ * rebuilding it so the secret cannot escape.
+ */
+function redactErrorText(error, patterns) {
+    const message = redactText(error.message, patterns);
+    const stack = error.stack === undefined ? undefined : redactText(error.stack, patterns);
+    return {
+        name: error.name,
+        message,
+        stack,
+        changed: message !== error.message || stack !== error.stack,
+    };
+}
+//# sourceMappingURL=secret-patterns.js.map

package/dist/shared/logging/secret-patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-patterns.js","sourceRoot":"","sources":["../../../src/shared/logging/secret-patterns.ts"],"names":[],"mappings":";;;;;;;AAAA,4DAA4D;AAC/C,QAAA,QAAQ,GAAG,YAAY,CAAC;AAErC,oFAAoF;AACvE,QAAA,2BAA2B,GAAsB;IAC5D,WAAW;IACX,WAAW;IACX,QAAQ;IACR,cAAc;IACd,eAAe;IACf,eAAe;IACf,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,YAAY;CACb,CAAC;AAEF;;;;;;GAMG;AACU,QAAA,6BAA6B,GAAsB;IAC9D,gCAAgC;IAChC,mCAAmC;IACnC,wDAAwD;IACxD,8FAA8F;CAC/F,CAAC;AAEF,sDAAsD;AACtD,qBAA4B,GAAW,EAAE,QAA2B;IAClE,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,oBAA2B,KAAa,EAAE,QAA2B;IACnE,OAAO,QAAQ,CAAC,MAAM,CACpB,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,QAAA,QAAQ,CAAC,EACpF,KAAK,CACN,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,qBAA4B,KAAsB;IAChD,OAAO,IAAI,KAAK,CAAC,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,UAAU,IAAI,CAAC;AAC5D,CAAC;AAUD;;;;;GAKG;AACH,yBAAgC,KAAY,EAAE,QAA2B;IACvE,MAAM,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxF,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,OAAO;QACP,KAAK;QACL,OAAO,EAAE,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,KAAK,KAAK,KAAK,CAAC,KAAK;KAC5D,CAAC;AACJ,CAAC"}

package/dist/shared/validation/primitives.d.ts

@@ -1,4 +1,4 @@
-import type { Redactable } from '../logging/redaction';
+import type { Redactable } from '../logging/redaction-walk';
 /** Throw {@link ValidationError} unless `value` is a non-empty string. */
 export declare function validateNonEmptyString(value: string, field: string): void;
 /** Throw {@link ValidationError} unless `value` is an integer within bounds. */
@@ -12,6 +12,14 @@ export declare function validateNonEmptyArray<T>(value: T[], field: string): voi
 export declare function assertNoControlChars(value: string, field: string): void;
 /** Throw {@link ValidationError} if `value` contains the reserved `separator`. */
 export declare function assertNoSeparator(value: string, separator: string, field: string): void;
+/**
+ * Validate a caller-supplied identifier that reaches a DynamoDB key: non-empty,
+ * free of the reserved `separator`, and free of control characters. The last
+ * rule matters even though DynamoDB itself accepts control characters — an
+ * identifier is echoed into logs, so an unvalidated ANSI escape is a
+ * log/terminal-injection surface for any app that writes these values out.
+ */
+export declare function validateIdentifier(value: string, separator: string, field: string): void;
 /** Throw {@link ValidationError} if nested-array depth exceeds `maxDepth`. */
 export declare function validateArrayMaxDepth(value: Redactable[], field: string, maxDepth: number): void;
 //# sourceMappingURL=primitives.d.ts.map

package/dist/shared/validation/primitives.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../../../src/shared/validation/primitives.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIzE;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,MAAM,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,IAAI,CAUN;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIxE;AAaD,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIvE;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOvF;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAahG"}
+{"version":3,"file":"primitives.d.ts","sourceRoot":"","sources":["../../../src/shared/validation/primitives.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAE5D,0EAA0E;AAC1E,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIzE;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAC7B,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EACb,MAAM,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,IAAI,CAUN;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIxE;AAaD,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIvE;AAED,kFAAkF;AAClF,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAOvF;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIxF;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAahG"}

package/dist/shared/validation/primitives.js

@@ -5,6 +5,7 @@ exports.validateInteger = validateInteger;
 exports.validateNonEmptyArray = validateNonEmptyArray;
 exports.assertNoControlChars = assertNoControlChars;
 exports.assertNoSeparator = assertNoSeparator;
+exports.validateIdentifier = validateIdentifier;
 exports.validateArrayMaxDepth = validateArrayMaxDepth;
 const errors_1 = require("../errors/errors");
 /** Throw {@link ValidationError} unless `value` is a non-empty string. */
@@ -53,6 +54,18 @@ function assertNoSeparator(value, separator, field) {
         throw new errors_1.ValidationError(`${field} must not contain the reserved "${separator}" separator`, field);
     }
 }
+/**
+ * Validate a caller-supplied identifier that reaches a DynamoDB key: non-empty,
+ * free of the reserved `separator`, and free of control characters. The last
+ * rule matters even though DynamoDB itself accepts control characters — an
+ * identifier is echoed into logs, so an unvalidated ANSI escape is a
+ * log/terminal-injection surface for any app that writes these values out.
+ */
+function validateIdentifier(value, separator, field) {
+    validateNonEmptyString(value, field);
+    assertNoSeparator(value, separator, field);
+    assertNoControlChars(value, field);
+}
 /** Throw {@link ValidationError} if nested-array depth exceeds `maxDepth`. */
 function validateArrayMaxDepth(value, field, maxDepth) {
     const depthOf = (node, depth) => {

package/dist/shared/validation/primitives.js.map

@@ -1 +1 @@
-{"version":3,"file":"primitives.js","sourceRoot":"","sources":["../../../src/shared/validation/primitives.ts"],"names":[],"mappings":";;;;;;;;AAAA,6CAAmD;AAGnD,0EAA0E;AAC1E,gCAAuC,KAAa,EAAE,KAAa;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,yBACE,KAAa,EACb,KAAa,EACb,MAAM,GAAmC,EAAE;IAE3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,eAAe,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,eAAe,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,+BAAyC,KAAU,EAAE,KAAa;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,cAAc,CAAC,KAAa;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,8BAAqC,KAAa,EAAE,KAAa;IAC/D,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,2BAAkC,KAAa,EAAE,SAAiB,EAAE,KAAa;IAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,wBAAe,CACvB,GAAG,KAAK,mCAAmC,SAAS,aAAa,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,+BAAsC,KAAmB,EAAE,KAAa,EAAE,QAAgB;IACxF,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAE,KAAa,EAAU,EAAE;QAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,mCAAmC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}
+{"version":3,"file":"primitives.js","sourceRoot":"","sources":["../../../src/shared/validation/primitives.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAmD;AAGnD,0EAA0E;AAC1E,gCAAuC,KAAa,EAAE,KAAa;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,6BAA6B,EAAE,KAAK,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,yBACE,KAAa,EACb,KAAa,EACb,MAAM,GAAmC,EAAE;IAE3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,qBAAqB,EAAE,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,eAAe,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC;QACnD,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,eAAe,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,CAAC,CAAC;IACxE,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,+BAAyC,KAAU,EAAE,KAAa;IAChE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,4BAA4B,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,cAAc,CAAC,KAAa;IACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oFAAoF;AACpF,8BAAqC,KAAa,EAAE,KAAa;IAC/D,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,sCAAsC,EAAE,KAAK,CAAC,CAAC;IACnF,CAAC;AACH,CAAC;AAED,kFAAkF;AAClF,2BAAkC,KAAa,EAAE,SAAiB,EAAE,KAAa;IAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,wBAAe,CACvB,GAAG,KAAK,mCAAmC,SAAS,aAAa,EACjE,KAAK,CACN,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,4BAAmC,KAAa,EAAE,SAAiB,EAAE,KAAa;IAChF,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACrC,iBAAiB,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;IAC3C,oBAAoB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,8EAA8E;AAC9E,+BAAsC,KAAmB,EAAE,KAAa,EAAE,QAAgB;IACxF,MAAM,OAAO,GAAG,CAAC,IAAgB,EAAE,KAAa,EAAU,EAAE;QAC1D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,KAAK,GAAG,QAAQ,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAS,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC9F,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,GAAG,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,wBAAe,CAAC,GAAG,KAAK,mCAAmC,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC"}

package/dist/store/actions/get.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../src/store/actions/get.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAK5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAItD,kFAAkF;AAClF,wBAAsB,OAAO,CAC3B,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAYtB"}
+{"version":3,"file":"get.d.ts","sourceRoot":"","sources":["../../../src/store/actions/get.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iCAAiC,CAAC;AAK5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAGtD,kFAAkF;AAClF,wBAAsB,OAAO,CAC3B,OAAO,EAAE,YAAY,EACrB,SAAS,EAAE,MAAM,EAAE,EACnB,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CA0BtB"}

package/dist/store/actions/get.js

@@ -16,6 +16,20 @@ async function getItem(context, namespace, key) {
     }));
     if (!result.Item)
         return null;
-    return (0, item_mapper_1.readStoreItem)(context, result.Item);
+    /**
+     * Narrow rather than cast. A foreign row sharing this key has no
+     * `namespace`, and one carrying a `value` PayloadDescriptor in the same
+     * shape a store item uses (a checkpointer WRITE row) would otherwise decode
+     * cleanly and be handed back as the caller's own value.
+     */
+    const record = (0, item_mapper_1.narrowStoreRecord)(result.Item);
+    if (!record) {
+        context.logger.warn('store.get: ignored a row that is not a store item', {
+            partitionKey: (0, keys_1.partitionKey)(namespace),
+            sortKey: (0, keys_1.sortKey)(namespace, key),
+        });
+        return null;
+    }
+    return (0, item_mapper_1.readStoreItem)(context, record);
 }
 //# sourceMappingURL=get.js.map

package/dist/store/actions/get.js.map

@@ -1 +1 @@
-{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../src/store/actions/get.ts"],"names":[],"mappings":";;;AAEA,uDAAgE;AAChE,yDAAwD;AACxD,2CAAyD;AAEzD,uDAAwE;AAGxE,kFAAkF;AAC3E,KAAK,kBACV,OAAqB,EACrB,SAAmB,EACnB,GAAW;IAEX,IAAA,8BAAiB,EAAC,SAAS,CAAC,CAAC;IAC7B,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAiB,EAAC,GAAG,EAAE,CAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,EAAE,EAAE,EAAE,IAAA,mBAAY,EAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAA,cAAO,EAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QACjE,cAAc,EAAE,IAAI;KACrB,CAAC,CACH,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,OAAO,IAAA,2BAAa,EAAC,OAAO,EAAE,MAAM,CAAC,IAAuB,CAAC,CAAC;AAChE,CAAC"}
+{"version":3,"file":"get.js","sourceRoot":"","sources":["../../../src/store/actions/get.ts"],"names":[],"mappings":";;;AAEA,uDAAgE;AAChE,yDAA2E;AAC3E,2CAAyD;AAEzD,uDAAwE;AAExE,kFAAkF;AAC3E,KAAK,kBACV,OAAqB,EACrB,SAAmB,EACnB,GAAW;IAEX,IAAA,8BAAiB,EAAC,SAAS,CAAC,CAAC;IAC7B,IAAA,wBAAW,EAAC,GAAG,CAAC,CAAC;IACjB,MAAM,MAAM,GAAG,MAAM,IAAA,yBAAiB,EAAC,GAAG,EAAE,CAC1C,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;QACjB,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,GAAG,EAAE,EAAE,EAAE,EAAE,IAAA,mBAAY,EAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAA,cAAO,EAAC,SAAS,EAAE,GAAG,CAAC,EAAE;QACjE,cAAc,EAAE,IAAI;KACrB,CAAC,CACH,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,MAAM,MAAM,GAAG,IAAA,+BAAiB,EAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,mDAAmD,EAAE;YACvE,YAAY,EAAE,IAAA,mBAAY,EAAC,SAAS,CAAC;YACrC,OAAO,EAAE,IAAA,cAAO,EAAC,SAAS,EAAE,GAAG,CAAC;SACjC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAA,2BAAa,EAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC"}

package/dist/store/actions/list-namespaces.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"list-namespaces.d.ts","sourceRoot":"","sources":["../../../src/store/actions/list-namespaces.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAmBtD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,YAAY,EACrB,EAAE,EAAE,uBAAuB,GAC1B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAsBrB"}
+{"version":3,"file":"list-namespaces.d.ts","sourceRoot":"","sources":["../../../src/store/actions/list-namespaces.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iCAAiC,CAAC;AAQ/E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAmBtD;;;;GAIG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,YAAY,EACrB,EAAE,EAAE,uBAAuB,GAC1B,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAuBrB"}

package/dist/store/actions/list-namespaces.js

@@ -30,6 +30,7 @@ function namespaceSource(context, op) {
  */
 async function listNamespaces(context, op) {
     (0, validation_1.validatePaging)(op.offset, op.limit);
+    (0, validation_1.validateMaxDepth)(op.maxDepth);
     const seen = new Set();
     const namespaces = [];
     for await (const raw of namespaceSource(context, op)) {

package/dist/store/actions/list-namespaces.js.map

@@ -1 +1 @@
-{"version":3,"file":"list-namespaces.js","sourceRoot":"","sources":["../../../src/store/actions/list-namespaces.ts"],"names":[],"mappings":";;;AAEA,6DAA+D;AAC/D,qDAA0D;AAC1D,yDAA4D;AAC5D,2CAAuD;AACvD,iEAAwF;AACxF,6CAA2D;AAE3D,uDAAwD;AAExD,SAAS,eAAe,CAAC,OAAqB,EAAE,EAA2B;IACzE,MAAM,IAAI,GAAG,IAAA,4BAAU,EAAC,EAAE,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAA,wBAAa,EAAC;YACnB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,IAAA,mBAAW,EAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;YAC5C,QAAQ,EAAE,OAAO,CAAC,YAAY;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAA,mBAAY,EAAC;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,IAAA,iBAAS,EAAC,OAAO,CAAC,SAAS,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC,YAAY;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,yBACV,OAAqB,EACrB,EAA2B;IAE3B,IAAA,2BAAc,EAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,IAAA,+BAAiB,EAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IACE,EAAE,CAAC,eAAe;YAClB,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,gCAAc,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAC9E,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAA,+BAAa,EAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,0BAAmB,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,0BAAmB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,0BAAmB,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"list-namespaces.js","sourceRoot":"","sources":["../../../src/store/actions/list-namespaces.ts"],"names":[],"mappings":";;;AAEA,6DAA+D;AAC/D,qDAA0D;AAC1D,yDAA4D;AAC5D,2CAAuD;AACvD,iEAAwF;AACxF,6CAA2D;AAE3D,uDAA0E;AAE1E,SAAS,eAAe,CAAC,OAAqB,EAAE,EAA2B;IACzE,MAAM,IAAI,GAAG,IAAA,4BAAU,EAAC,EAAE,CAAC,eAAe,CAAC,CAAC;IAC5C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpB,OAAO,IAAA,wBAAa,EAAC;YACnB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,MAAM,EAAE,IAAA,mBAAW,EAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC;YAC5C,QAAQ,EAAE,OAAO,CAAC,YAAY;SAC/B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,IAAA,mBAAY,EAAC;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,MAAM,EAAE,IAAA,iBAAS,EAAC,OAAO,CAAC,SAAS,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC,YAAY;KAC/B,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACI,KAAK,yBACV,OAAqB,EACrB,EAA2B;IAE3B,IAAA,2BAAc,EAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACpC,IAAA,6BAAgB,EAAC,EAAE,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,UAAU,GAAe,EAAE,CAAC;IAClC,IAAI,KAAK,EAAE,MAAM,GAAG,IAAI,eAAe,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,IAAA,+BAAiB,EAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QACnC,IACE,EAAE,CAAC,eAAe;YAClB,CAAC,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAA,gCAAc,EAAC,SAAS,EAAE,SAAS,CAAC,CAAC,EAC9E,CAAC;YACD,SAAS;QACX,CAAC;QACD,MAAM,SAAS,GAAG,IAAA,+BAAa,EAAC,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,0BAAmB,CAAC,CAAC;QACtD,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC;YAAE,SAAS;QAClC,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IACD,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,0BAAmB,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,0BAAmB,CAAC,CAAC,CAAC,CAAC;IAClG,OAAO,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAC3D,CAAC"}

package/dist/store/actions/put.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"put.d.ts","sourceRoot":"","sources":["../../../src/store/actions/put.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AA+DtD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBpF"}
+{"version":3,"file":"put.d.ts","sourceRoot":"","sources":["../../../src/store/actions/put.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AAcpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAgFtD;;;;;;GAMG;AACH,wBAAsB,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBpF"}